Note: <system folder> refers to a variable location that is determined by the malware by querying the Operating System. The default installation location for the System folder for Windows 2000 and NT is C:\Winnt\System32; and for XP, Vista, and 7 is C:\Windows\System32.

Payload

Contacts remote hosts

Trojan:Win32/Danmec.M may contact the following remote hosts:

216.40.204.106 using port 80

67.18.156.178 using port 80

67.19.9.186 using port 80

ns.uk2.net using port 53

www.web.de using port 80

www.yahoo.com using port 80

Commonly, malware may contact a remote host for the following purposes:

Please note: While your feedback is very important to us, we do
not respond to individual submissions through this channel. Feedback, requests,
or questions submitted through this form are monitored, however responses are not
generated. If you require support, please visit the
Safety & Security Center.